No "Owners" option for Protected Environments

It seems crazy to me that “Owners” isn’t one of the optional Roles in Protected Environments. It seems like that would be the actual most important value to have there. I see very few tasks in the issue tracker on the topic, and none are open.

There must be a way to actually protect an environment to a limited group of users without having to click on individual names for each environment. With “Maintainers” being the highest level, I have no way to say, you can merge but you can’t deploy production. That is, without hours of work clicking individuals or scripting against the API.

Is this a design decision or just an oversight? Or perhaps I’m just not seeing the obvious way to do this?